OODAcast: Mischel Kwon, Founder and CEO of W@tchTower

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com hello, I'm Bob Gourley, the Chief Technology Officer of OODA llc. And today on the oodacast, Michelle Kwan. Michelle, how are you doing today?

I'm great, thank you.

Michelle, I've known you quite a while and I'm so excited to talk to you today because, I mean, you have so many lessons for us across multiple domains. You have succeeded as a developer, you've succeeded as a government executive. You have now created a company and have succeeded as a CEO and would love to talk to you about all of those aspects of your career.

That's great. Thank you.

So let's start at the beginning. Michelle, I'd love to get in your words, your foundational story. What started all of this for you? How did you get involved in technology?

Oh, it's an interesting story. As many children of a very strict Asian parent, it all started with a C. My father and I had an agreement that I could go to college, but if I got anything below a B, my time in college would end. So I got a C in French. So coming out of that trauma, I was shopping one day in the mall and I took a logic test for Computer Learning Center. I don't think they exist anymore. And I did really well and ended up going to Computer Learning center and learning many of those old languages. Assembler, cobol, Fortune, Lisp, you know, all those interesting old languages. And from there I went to work on a project with Woodrun, Lothrop and IBM developing the first automated cash register system and the first automated credit check.

That's pretty neat because, I mean, that stuff, it's everywhere now. And that was the first kind of foray into that for IBM.

Yeah, it was. And it was. It was the time where we used to. I feel so old saying this, we used to handwrite all of your sales checks when you went shopping. Can you imagine waiting for someone to write down all the things maybe that inhibited people shopping their list, how many things that they actually bought because it would take too long? And I remember when we did the first automated check, it took three minutes. And that was our goal to get, get it to be three minutes. Can you imagine waiting three minutes for your, for your credit check to finish?

Not today. And you look at these like your modern Amazon stores. You walk in, you walk out. It's instantaneous.

And we thought it was great. We thought it was super fast and we thought it was the nest thing. So that was pretty fun. So from there I moved on and I've done all kinds of things. I worked on the first automated patch management system for large mainframes that was so complex that they sent me to charm school and sales school and they asked me to sell it because they couldn't. It was very technical. And what I did was I went to people's data centers and I took the tape under my arm, revealed the tape on and. And we patched their mainframes with the system and. And that was, that was an interesting little part of my life and I'm very grateful for that part of my life because before then I was. Not that I'm not a little geeky around the edges now, but I was pretty non public facing before I went to ended that. From there I went and worked at Quest and Unit on platforms that auto config NASA's and groom circuits. So by then I had a lot of experience and a lot of experience around operating systems, applications, the staff and networking. And I wanted to go finish my degrees. I definitely hit a ceiling where I knew I couldn't advance any further without my degrees, or at least that's the way I felt. So at first I went and I got a Claire Bruce Loose scholarship for math. And I thought I was going to be a mathematician, you know, still at 38, I couldn't decide what I wanted to be. I think that's pretty funny. But then they offered me the Cyber Corps scholarship and I thought long and hard about it and looked at security and I thought, well, you know, I have all the different types of experience within it, security kind of expense. And so I did both my undergrad and my grad and got my degrees in computer science with a minor in. What is it called, an Information Assurance Master Certificate in. That's what it was back in those days in cybersecurity. They called it Information Security and a minor in math.

And what year was that?

I'm not gonna even know. 84. 84, 85. And then from there I went into the WI fi shootout at defcon and I won Most innovative antenna because I read the instructions. Well, I thought that you couldn't have any antenna parts, so I made a box antenna and it used the metal weather shields for the car and wiggle sticks. And I really was being kind of funny about it and they said that we needed to know how far it would shoot and I said it'll shoot about a mile. We did the math and we designed it to shoot about a mile and we sat right below the kids that did the big antenna. And of course they won the whole thing and could have won everything. They stopped doing it after that because, you know, there was no competition after that. But I was really proud that it shot a mile and we got most innovative antenna for that. And I got a job. DOJ noticed me and they interviewed me for their director of wireless security. So I know I wasn't the normal cybercore kid. I had a lot of IT experience behind me, which is why I was able to go right into that position.

Yeah, Michelle, I think there's some kind of lesson there for folks today, and that is sometimes you do need to stand out by being yourself. You know, don't be afraid to be yourself. And you may get noticed.

And you have to do things that you enjoy. You have to put it into the context that you understand and you feel comfortable in. I think that's really important. There's so many areas you can specialize in and enjoy. And the other big lesson from that is you do not have to do the same thing your entire career. In fact, it makes you better to stand up and turn around and do something different. And after I was. After I did the land mobile radio systems and wireless networks for doj, which was the most fun job I think I've ever had. It was. And I probably did the best things that I've ever done. You know, working with Motorola to better secure those trunk radio systems was probably the biggest accomplishment of my career. And people don't know that, but it really, really made a difference. And I'm super proud of that. But then from there I stood up and turned around and I became the deputy director to the CSO at doj and I built the Justice Security Operations Center. And from there I went on the US Cert. So that was a big stand up and turnaround again. And it seemed like every four or five years that's what I've done in my career is turned around and did something a little bit different. And I think it's made me what I am today. It's given me a nice place, broad understanding of it and security, and it's just made for a really enjoyable career. That's great. That's great.

That's the foundational story and that's how you got into not just the government, but cybersecurity. It was an early day. You were a pioneer and you needed to create security operations centers and help raise defenses. I also remember the US Cert in its early days. So always doing good work from the very beginning. But it needed a Boost. And it needed to level up to support some of these new missions of really helping protect all infrastructure.

Not just was really surprising how, how hard it is to do that on the national level. Once politics enters into the game, it makes security even harder. And that's, that's the big lesson I learned at US cert. I mean, it was a shock to me to realize just how many people in very high places and very influential spots did not have a clearance and had never had an appropriate threat briefing. We had designed all of our compliance programs without any of those people ever being briefed on the threat. And that to me was just shocking. So we sponsored a lot of people getting their clearances. And I think the biggest thing that we did while I was at US CERT was start what we call the Jackie meetings. And basically the Jackie meetings were bringing all the federal employees and contractors who were cleared in for real threat regions and teaching, you know, all the intrusion sets and how to identify them. That was really meaningful. And it, I, they occasionally, I think they still have them periodically. We used to have them every two weeks. Got to where we couldn't find a big enough cleared area to do them in. There weren't, weren't big enough rooms to do that. And I think it really pushed the government to clear their sock people and give them good threat briefings.

I think there is definitely a leadership lesson here for people in government today, and that is even if you're not in direct command of someone or something, you can still give them information and lead them to the right conclusion and raise their awareness.

And you know, that was a really big thing. When I got to New Western, one of the things from my teaching, I was also teaching cybersecurity to the Cyber Corps students at George Washington at the time. I taught for eight years and I would teach cohorts the whole time they were in getting their master's degrees, they would have a class with me. And one of the things that we taught there was the Constitution. And that was the biggest aha moment for me at US CERT was applying what I knew to the Constitution, to my job, and realizing how many people did not know what the Constitution said about the way the executive branch behaved and the way you could and could not interact with DoD. It was just eye opening how many people did not realize that there was, there were rules and there was a doc, there was a Constitution that everyone needed to follow. And that was pretty eye opening to me. And we had a lot of, you know, I remember even being at the Joint Staff briefing. And I remember watching the AIDS brief and realizing we can't do that. That's not constitutionally legal. And, you know, those kinds of experiences are profound. And you realize that there are rules for a reason and that your job is much more than just technical cyber, that it's people, that it's roles in the government, that it's, it's a lot of different things. It's understanding history, understanding how we got there. So that was a super interesting and very meaningfully meaningful job and lots of learning, but much different than I think people realize. People say, oh, well, they can just share information or, or the DoD can just do that for us. And they don't realize that they're actually very firm rules and their roles. And you have to be able to respect and appreciate those.

Yeah, Michelle, it's totally consistent with my observations too. It really is. From my early days at jtfcnd, we had a lawyer on our staff for good reason, who helped to educate us on the Constitution, the law, and the way the law was written and why it was written that way. It was just so critically important. And I think the point you're making underscores that if you're a technologist and you want to grow and to have increasing responsibility, you may need to broaden your own personal views through reading and study and awareness of things like the Constitution or reaching out and learning why the policy is that way.

And it applies much further than just the government. In industry, each industry has their own charters. They have their own rules, they have their own regulations. And it's important to understand that security is so tied to a business. And you really have to understand your business, whether it's the government and understanding how the government operates and understand what your agency does, or whether it's your commercial industry and understanding more about your industry writ large, understanding what makes your company drive, what is their mission, what is their purpose. These things make a security professional much more valuable if they understand what they're protecting and how they're protecting them.

That makes a lot of sense. And that's a good segue into discussion of what you've been up to lately. I do want to say that there's a phrase we hear a lot about highly regulated industries, and I use that word too, because some industries are regulated more. But the point I want to make is these days, every industry is regulated. It's just everyone has to comply with the rules, either SEC or some best practices or generally acceptable accounting practices. You all have to protect your data. And HIPAA does not Just apply to health care. It's anybody who has employees, if you got health care info on them, you.

Got to protect it.

So it's almost like every industry is highly regulated. I mean, some more than others.

Well, you know, it is kind of interesting because I know that security people, kind of as inner core, always feel like we need to be creative and drive our own bus and do things the way we want. And sometimes those regulations crimp our style. But we have to realize that in life, doing best practice is important and measuring that best practice is important and ensuring that you have the guardrails to do those right things is important. And I think that's what regulation tries to be. Sometimes it hits the mark, sometimes you know, it doesn't. But like anything in life always needs adjustment. And I think that's really what I've been doing for the past 10 plus years, is trying to figure out how we do security operations in a better way. So for the past 10 years I've been developing a methodology and a product that is a platform that helps to keep SOC in a good place, helps you manage it, manage all the products, all of the data, understand the right processes and then measure those people performing those right processes.

Now, in this 10 year journey to do this, first you were MKA Cyber, but you have rebranded now to Watchtower. Right.

So we actually started as Michelle Kwan and Associates because at the time I was just coming off my US Cert gig and and they felt that I needed to use my name. I'm a little bit of a introvert and so that has always been a little bit difficult for me. So we've wanted to move away from my name for a couple of years. And as we turned and we released the very rich product, we really wanted the product to have its own name. So we changed our name to Watchtower and that is the name of our product and our company today.

That's a good brand, I think, because when I hear Watchtower, I think someone's looking over my stuff and if they see something, they're going to tell me. And maybe for my Watchtower, I can take some action also. I think it's a pretty good brand.

That's right. And looking at it as a Watchtower, you can be a Watchtower over your entity or Watchtower many entities. And we felt that that was important to have a multi tenant environment for security operations at U.S. cERT. I would have loved to have a multi tenant environment where 127 different agencies could report up and have the same best practice practices. I would have loved that. So that was the idea behind the Watchtower and, and that's what we've created.

Great. Then how do you describe then what your company does?

Well, we are. The Watchtower is our product and everything we do is driven by what our product does. We have what we call an MSSP or soc services that back up our product. So most of our clients have both the Watchtower product and some amount of support, whether it be round the clock or shifts of support monitoring networks. But we really are based around setting up very quickly a best practice SOC in our clients environments, being able to help them measure the usage of their tooling, the being able to connect their data together. We really feel like it's super important to understand the ioc, the indicator of comparable to the cve, to the state of the network, to possible tickets involving those IOCs and the understanding of remediation. That's a really hard pattern of data to follow through many shiny objects of tools and we feel like we've mastered that and being able to report back out to the ciso, both the health of the network, things that will happen next, the status of remediation. So from a security perspective, even the trends of attacks over time to being able to employ good workflow for the analysts and have that workflow be fed by some good orchestration and automation that makes their job easier. So they have a very sound analyst workbench and then being able to report also on how is our performance, how are we doing, how often are we clearing the queue, what is our detection rate, what is our remediation rate. So we're able to measure a lot of things and ensure that we're keeping in that best practice standard and really serving the organization well.

Best practices change over time. Have you built in any way that, how have you built in agility? I guess the way I want to.

Ask that it's really great. Well, for one, we like to take in new products as connecting through API all the time. So we're constantly adding new products to the products that feed the Watchtower. We are always updating and improving workflow and customizing workflow. So we've created SOC analyst workflow for enterprise networks, all different kinds of enterprise networks, cloud networks, different kinds of cloud networks, different layers in the cloud network and also ot. We've done a lot of work around different types of OT networks and application. So we're constantly improving that workflow which pushes us to improve our orchestration and automation and also pushes us to improve different types of data connection. So this is an ongoing process. But we do it in a way in which we can package this up. We containerize it so we can deploy it in any cloud environment, even on prem, so that we can deploy a SOC in a short period of time.

That's great. That's great. You can deploy a SOC and then a company can operate, manage that soc themselves, but still have you as reach back. Is that correct?

Absolutely, absolutely. Or we can do it for them however they want it, we can ride alongside of them, we can just be consultants. However much help they need, we're there for them. Great.

That's a good model. And I also want to ask there, you know, so clearly you've been, as I mentioned at the beginning, you were entrepreneurial across three domains. You were entrepreneurial in the development world and creating there in government. You, you were entrepreneurial and improved things through new methods. And now you've had a decade of building as an entrepreneur. This company, Watchtower. I guess the basic question is you've done that across three domains. What kind of lessons do you have for the young entrepreneur just starting out today? What's the secret to your success?

Oh, constantly learning. You have to, you have to constantly learn and be open to listening to other people and hearing their ideas. That's super important. Be brave. Sometimes the steps that you have to take aren't the easy steps. You really have to take a moment and sometimes do things that aren't popular. Sometimes do things that you know are right. Believe in yourself. I think that's probably the biggest thing.

Okay, great. Good advice. There's another question I am just dying to ask you, Michelle, and that is about books and reading. What kind of.

It's interesting because I don't have a lot of time these days during this pandemic to do reading enjoyment reading for myself. I do professional reading and lately I have been doing a lot of reading with my 10 year old daughter. The pandemic has really given me an opportunity to do something with my last child. I have five children and I worked through all of them and probably spent a lot more time away from them than I wanted to. And this pandemic has given me the opportunity to spend more time with my 10 year old. And so we read together and I read a lot of the literature she reads so that we can discuss that literature. And it's been very eye opening, really very enjoyable. You know, when you read books that you read as a child and she's in sixth grade now, so it's a little more mature reading than a regular children's book. When you read books that you've read as a child and you read them now, you realize that society has changed and some of the things that they used to write about are just so not appropriate today. So it leads to a lot of really good conversations about how to build social norms change and why were they like that then and why, why are we like we are today? So it's been really enjoyable reading with her and, and going on her learning journey with her. It's been very, very, very enjoyable.

You know, it sounds like it is enjoyable and it also hits that point you mentioned previously about the need to keep learning. I think it does seem like a good way to keep learning is revisiting something some of the books you've read years ago and you know, the other.

Way of relearning is having to help her with her math. That's been also fun. She tells her teacher all the time she has a mathematician for it. For a mom, I don't know if I quite qualify for that. But this is definitely this change in life with this pandemic. You have to look at the bright side. And the bright side is I've had almost a year of amazing quality time with my 10 year old and really participating in her, learning from her. It's been, it's been really great.

That's great. I have one final question, Michelle, and that is about the cyber threat. Do you have any insights for us? I know you're involved in helping protect networks and protect organizations and missions. How do you see the cyber threat evolving in the near future?

Well, you know, it's interesting. I think as society changes, the threat changes. I think a lot of things influence threat just like a lot of things influence physical crime and the way they influenced physical crime a long time ago. You know, that's interesting. You see those, you see things like that in these books from these different adventures from a long time ago. You know, we are people as the base and whether, whether something's going to happen technologically or physically, more things are moving and have moved to the technological base of crime and espionage and even war. So I think as society continues to change, the threat will continue to change. I think it's the political, we've seen change that follows political change. And I think we will once again see another shift in change over the next few years and that will continue. What people do to each other and how they feel, whether their enemies or friends will change the way they attack each other, whether it be physical attack or whether it be technologically so I think we will see some changes. Just like we've seen changes over the past four years, we'll continue to see those changes.

I think this also underscores why any company that wants to endure and be in it for the long run needs to stay agile. And they need to have partners like Watchtower to help them be agile with best practices and best technology.

And they have to understand that everything they do affects everything else. So what they say in the press, where they release product, where they, where they have offices, the different people they hire, the different things they say on social media all affect their cyber presence. And, you know, I think that's the thing that we. I think we get that now. When I first started in cyber, we didn't get that, but I think we realize now that cyber is much more connected to the real world. It's not just the technology.

All right, great. Michelle, thanks very much for the time today. I really appreciate these insights.

Well, thank you. Thanks for having me on.

All right, we'll see you.

Thanks for listening to this. OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.